This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
in a fag phone.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable, I'm able to get that stable.
On the out, my name is Ace and I'm a Leo.
On the digital highway, my name is Neo and I'm a Nero.
In a flash, I'll screw you on burning dreamcasts.
You need some ISOs? Let me through my hard drive rifle.
Our exchange you could never stifle.
In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattle in your bones, when I tell you we just hacked out Jones.
And NASDAQ leaves your fight on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crackers.
Serial code, source code, ISO, RAN.
Hello, happy Pi Day, and welcome to Binary Evolution Radio, episode number 139, from March 14, 2006.
I'm Strom Carlson.
I'm Black Ratchet, and what's this evening is...
I don't even... I've never actually shared this.
Is it Dubeeve or Beeve?
It is Dubeeve.
Dubeeve.
So we have Dubeeve with us, of Telefreak Frame.
Yep.
Yeah, I guess so.
Yeah, Telefreak Frame.
For those of you who don't know what Telefreak is, it's a...
What is Telefreak?
You can actually...
I've never been...
It's a conference and a bunch of voicemail boxes and other stuff and VoIP goodness.
Actually, yeah, it's a teleconference bridge, stuff like that.
It's also just a small group of us who just enjoy screwing around with Asterix and developing software
and just having a good time, you know, between our small little group of people who actually
run Telefreak itself.
You mean there's people who don't enjoy developing software for Asterix?
But how is that possible?
Well, this is true.
Well, I mean, we do other things outside of that as well.
But, you know, just a little project, just a little group of us, you know, hacking away
and stuff.
General messing about.
Exactly.
We are live tonight and we have Dr. Zygmunt on the phone lines waiting for your phone calls.
So if you want to go call in and we're looking for phone calls tonight.
I mean, we do have a topic.
I actually posted in the IRC chat room today that please listen to the episodes and send
us email because we got nothing and I've had two or three people say, have you found a topic
for tonight's show yet?
And I said, yeah, we've had a topic for a while.
And people were incorrect in assuming that when I say, please email us, we got nothing
to mean, please email us, we have no email instead of, please email us, we do not have
a show topic tonight.
So, I think snow topics are more popular.
Either way, no one emailed us.
Well, we have like one email, don't we?
We have one email.
We can always fabricate the email.
That's about it.
I was actually tempted to do that.
I was tempted to just write like four or five emails to you, Strom, on why you're constantly
picking apart people's grammar and why you never update the archives.
Well, the lack of archive updates, which there are up to date now, has been due entirely
to my procrastination and holy God, can I procrastinate?
Like, no, you're busy.
I thought I was lazy until I met you.
Yeah.
Like, seriously, it's just a...
But we are live tonight, laziness and more.
So, I probably should take an oath or something to update the archives.
Oh, we already have that covered.
Yeah.
Trying to steal my thunder here with my oath, so.
I thought we were going to do a live on the show.
So, email tonight is eight...
Well, we are going to do a live on the show, we're just going to do it after the email.
Oh, ho, ho, ho, ho, ho.
We're going to have 888-9-BINREV for your phone calling us, so, you know, call up,
or call Beave, or whatever.
We're looking for topics tonight.
Yeah.
No.
Also, apparently, our phone number does work in Britain, according to the person.
He emailed me today, or emailed me at some point in the past couple of days.
So, that's 08...
Hold on, see if I can't pull it up here.
I just read this just before the show.
0800, dog ball.
If you remember our UK call-in number, here we go.
It's 0845...
Oop, and that's not it.
Whatever we gave it before.
0845-123-4567.
Who cares?
No one's listening in Britain anyway.
Yeah, I'm unprepared.
Go, go, go, go yell at me.
Shall we just delve directly into the email?
Yeah, why not, unless you've got some sort of housekeeping to take care of.
No, I think that's basically it.
Yeah, the UK call-in number, for those of you curious, are 0845-646-0102, which allegedly still works as of today.
And what the person has been very nice and sent to us, he actually will...
When you call the phone number, you will hear a recording saying that it's going through, and it will ring our call-in number.
So, if you don't hear that recording, there's something messed up, but hopefully you should hear a recording.
It doesn't actually say what the recording is, for all we know.
It could be a busy signal.
It could be, you're calling Dogballs Incorporated.
Please hold.
It says, I have just updated the dialing plan, so it plays a wait message before dialing the BRR number.
I wonder what a wait message is.
Probably something I'd please hold while we complete your call.
Yeah.
The following phone number is not free in the UK.
So, what's our first and only email tonight there, Strom?
Our first and only email is from Machinescrew.
He writes, I just got a new PSP and got the 2.6 firmware, which includes an RSS slash audio podcasting client.
I have many shows on the thing, but it seems that you dropped as of February 25th, because I have so many shows I listen to, I can't remember all the times the shows are live.
There is, Newsreel, DL.TV, Hack.5, Twit, Twat, Linux Link Tech Show, The Source Show, Security Now, Dignation, InDigital, so please put up the dang thing.
Also, in response to the DIG suing gig, that is also not true.
According to him on Twit, when asked about it, he found it as a compliment.
So, this actually illustrates a couple of very interesting reasons on why people should update podcasts when they have archives.
A, we've updated, we've answered the Twit questions for the past three episodes.
Or, not the Twit question, the, uh, the YIG slash DIG question, and we've had two or three people say, hey, it's on, it's Kevin Rose, he was on Twit.
But, no one knows that, because someone didn't update the archives.
And, also, we have people who are very angry with people who do not update the archives.
I actually was sick and tired of receiving the hate mail, so I updated the IRC topic recently, and actually said people to talk to Strom.
And, I guess it worked.
And, yeah.
So, my incredible guilt finally got the best of me.
I guess so.
So, Strom, raise your right hand and put the other hand on your computer or something.
I'm going to raise my right hand and put my other hand on my telephone.
Okay, or that.
I, Strom Carlson.
Will update the archives.
You forgot to do solemnly swear.
Well, you, I don't know.
I don't do these things.
Let me make it up as I go along.
I, Strom Carlson, do solemnly swear to update the BINREV radio archives the night we broadcast the show, and if not, to do it as soon as humanly possible so that you, the listeners, can listen to your wonderful podcast instead of bothering to listen to us live.
Amen.
Well, because certain people can't listen to us live.
They're not a, like, crazy person who were in Germany who listened to us live that one time.
It's like 3 a.m. or something.
He, he, he might be, he completely does not know that we could have read his email on air because someone didn't update the archives.
But, either way.
Anyway, our archives are updated now.
I wish you'd just refer to me directly instead of calling me someone.
Well, I'm, I'm just, I, I, I enjoy, it, it just further degrades you, I think.
Aw.
I love you too, Ratchet.
Yeah, seriously.
If this was, like, default radio and I was decoder, like, you, you'd be fired by now.
How about fuck you and I'm opening a Starbucks?
I think we should start taking, uh, bets on how long it takes them to, uh, update.
How long it takes them to fall behind.
I'm, I'm, I'm giving, I, I think the over-under should be two weeks.
I mean, he, he, it won't be this week, but it'll be next week that something will go wrong.
Yeah, go for a time frame, yeah.
I, I think he's going to do it for about a month.
And then, you know, get busy, you know, real life stuff, and then, uh, kind of fall behind.
Then he'll have to take the oath again.
Yeah.
I don't know, what, what, what, what should be the punishment if you don't update the archives?
Hmm.
Something involving lube?
You'd enjoy that.
Look, anyway.
Yeah.
Okay, we're, this is just, like, completely going nuts right now, because as soon as we
start talking about lube, I just, like, no, no, no, no, no, no.
So, that was our one email tonight.
And, uh, hopefully we'll get tons of email next week because people will listen to the
last two episodes and will have questions and comments and such.
So, anyway.
So, uh, personal hacking stories.
Strom, what have you been doing since you've had copious amounts of free time without updating
the archives?
Are you kidding?
I had copious amounts of nothing.
I've been busy like crazy.
I haven't done much hacking.
Like, pretty much all I've done is I've done virus scans and stuff.
Hmm.
Virus scans are fun.
Yes, and I've contemplated rebuilding my Windows box because it's gone straight to hell.
You mean there was a point that it wasn't going straight to hell?
Well, no, but I'm saying it's been on the journey for quite a while and now it's there.
Like, it's arrived and there's no worse it can get.
What's the rule of thumb?
At least for NT, for me, it was you've got to reinstall the box at least once a year.
Yeah, this, I think, has been since, I think, maybe April?
May or May or June or something?
Yeah, with 2000 it got better, but with literally, when I was running NT4, you had to install it
at least once a year because it was just, it got horribly slow.
At least for me.
Of course, I think part of the problem was it was just fragmented to hell and there was
no defrag built right into NT4.
So, that was always annoying, but, yeah, so it was once a year.
Basically, every June, when I started working at my co-op, I would have the same computer
because I would work there part-time during the winter, but every year I would, like,
June, right before I started full-time again, I would just backup everything, reinstall it,
spent, like, you know, six hours reinstalling it because you had to reboot after you installed
every freaking driver.
And, uh, that's what I did for a day.
I just reinstalled my box.
By the time I started full-time again, it was nice and zippy and responsive, and then it
just started the downward spiral once again.
Yeah, also, I bought, like, a 400-gig hard drive to put the new install on, so that should
be fun.
Yes, because, you know, everyone needs 400-gig hard drives.
Is just me or, like, the hard drive space just, like, getting way out of hand lately?
It's just getting huge.
I think that there's a decent demand for it.
I mean, there's this explosion in digital media, and, I mean, pretty much if I had tons
of hard drive space, I'd just have MP3s up the wazoo, and video, and don't forget, every
episode of BINREV takes up quite a bit of space anyway, because I keep all the original
files.
I mean, that's the only thing that I can see taking it, and only that would say it's, you
know, 64-bit MULAW, so, like, that's like 150 megs of pop.
I mean, when you start, like, zooming it out, or what is it, or, like, stretching it out
to, you know, 44 kilobits a second, it starts getting pretty hefty, but at the same
point, you know, oh, whatever.
I don't know.
I can't foresee a use of a 400 gig hard drive.
I have an 80, and I have a 160, and 160 is mostly full because I have, like, two or three
computers backed up onto it that I've had to do consulting work on and reinstall.
Yeah, and I also back up a lot of my DVDs and whatnot, so, of course, that takes up quite
a bit of space as well, just so that I don't have to use actual DVDs and scratch them up
and lose them or anything, so I always leave them on my hard drive.
So I can watch them in the living room watching TV or at my computer or whatever I want.
Let's not forget porn, too.
Well, that's what I meant by videos and DVDs.
Yeah, personally, I wasn't going to go there.
I wasn't going to call him on it like that, but I guess if he admitted it himself, I'm always
willing to go there.
Well, technically, he admitted it to it, so it's like, I was going to say, oh, so what
are those videos of?
Oh, you don't want to know.
Well, technically, I have an 80 gig hard drive, and I actually decided 20 of that for Linux,
so I don't know what the space of that is.
And I have like, you know, 50% free on it, and I actually don't know what's taking up
that much space.
But meanwhile, on my storage hard drive, I only have 36 gigs free out of 150, so I don't
know.
Most of that's like, you know, I know like 30 or 40 of that is just this one laptop, and
this college student completely messed it up, and his mother gave it to me, and I backed
up all the stuff, including his, like, you know, gobs of MP3s.
I was actually saying, ooh, look at all these MP3s, and it was like, oh, like, you know, Jay-Z
and Kanye West, and I was like, ugh.
I got excited there for a second, and I was like, ooh, I could go further.
Well, at least that's marginally preferable to, like, Britney Spears.
Not by much.
That's why I said marginally.
Oh, okay.
I'm about to do the hard drive shuffle and move, I think I've got a 200 gig drive that I'm
going to put in the new asterisk box I'm going to build, and replace the current one,
because that one's all full.
Actually, speaking of hard drives, I think one of my server hard drives is going, which
is annoying, because it's also my asterisk box, so.
Actually, I know for a fact that two of my server hard drives are going, but those are
just, I used for storage, which are in there.
Sad that they're dying, but at the same point, I really can't complain, I guess.
Should we take a call?
I don't know.
I guess we could take a call.
Yeah.
Take a call.
Just a second.
You guys keep talking.
All right, yeah, so I got, like, you know, 160 gigs of storage, but it's, they're slowly
dying, but my computer has recently decided to start acting very, very slow, and the only
thing I can think of is either it's, it's got to be the hard drive, because I knew it was
kind of randomly powering down.
Making that, ooh, it's powering down?
Yeah.
Not good.
Yeah, it was, like, I'd be saying, I'd be saying.
It's viral downward.
Yeah, I need to go back that stuff up.
I'd actually need to find out which hard drive it is, because there's two in that box, and
that could be messy.
Yeah, that should probably be something you do, I don't know, directly after the show.
If the drive is powering down.
Yeah, I think I'm going to.
Well, the drive's been powering down for a couple of months now, but it's, and I have,
the stuff I have on it has been backed up, so it's just mostly, well, let me go ride
this sucker into the ground, shall I?
Well, I've seen bad hard drives last, like, six months, you know, or just people refuse
to replace them, and then whenever, of course, and it dies, and then they bitch about, you
know, they lost their data, you're telling them six months ago, hey, you're getting, you
know, read errors on your drive, but, yeah, still don't want to replace it.
Hey, it's still working.
It's still chugging along.
We have Red Rabbit on the line.
Well, well, well, well, well, hello, Red Rabbit.
Yeah.
So, yeah, I've been talking to you, I see, for a while, and you still haven't done my
iWord page, so just thought I'd call.
I think he's referring, he's referring to me, and he has a wiki page for, let's see, telephony
technology and stuff like that, and he's going to want me to update it, and I just haven't
had time.
Sorry.
Yeah, it's pretty boring, just thought I'd tell you that.
All right.
Look at that, Colin Beavout on the air.
Ooh.
I know, man.
This is better, this is better than WWF.
And you know what?
I'll get it done so much faster now, let me tell you.
Yeah.
Yeah, now that it feels like an obligation instead of something you just want to do, right?
Yeah.
Exactly.
Hey, just Red Rabbit, just look on the bright side.
At least Strom's not updating it.
Yeah.
Okay, well.
Well, I did tell him that I would do it, and I just have not done it.
And I do apologize.
I'll get it done.
Just give me a little bit of time.
All right.
See you.
Thanks for calling.
All right.
So, yes, actually, getting back to hard drives, what I was going to say was actually my fiance's
hard drive, which was part, I guess it was part of my personal hacking stories.
My fiance hard drive, Wednesday, her computer just refused to turn on.
It was just sitting at a blank cursor.
I was just like, I don't know what the heck's going on here.
And eventually I turned it off, turned it on, and, you know, a couple of times the power
cycle ended and it magically restored.
I said, you might want to back your stuff up.
We'll do it this weekend.
And Friday night, you know, she comes in, we're going to do it Sunday, and Sunday morning
she powers it up, nothing.
It just sits at the login screen and it crashes when it starts up.
So I had to trudge over and salvage all the stuff out.
It was a very interesting Sunday and Monday night.
I was sick as a dog, yet I was still scraping stuff off the hard drive.
Have fun, fun.
But I would just like to send a wonderful shout-out to BARTPE, which is BART's pre-installed
environment, which is, for those of you who don't know, it's like, basically it's Nopix
for Windows.
It's a very good bootable CD, and basically what you have to do is you have to have a full
copy of Windows XP, and you can create this bootable ISO image and burn it to a CD that
will boot a stripped-down version of Windows on your computer.
And, you know, Nopix is a lot more full-featured, and a lot of the stuff in the Windows one is
a kludge, but it's very handy for, say, removing spyware and directly interfacing it.
And it's a lot handy when you're already working in a Windows environment.
Say, like, for example, the hard drive is NTFS, which is a slight bear to work with, with
Linux.
So, BARTPE, it's the best thing ever.
And I think I might, I think we should, like, do a show on, like, BARTPE and Nopix and bootable
Windows and all that kind of stuff.
The URL for it is tinyurl.com slash Quebec Papa Kilowatt Yankee.
And, uh, as for my other person, I don't know, what else have I been doing this week?
Um, I've been doing some stuff relating to the show topic, and we'll talk about that later.
And, um, yeah, that's basically it.
I've been sick.
And I don't like head colds.
One great thing whenever you lose a hard drive, especially if it has Linux on it, is a DD Rescue.
I don't know if you've played with that.
But, uh, that's a very useful utility.
But even if the drive is physically failing, if you let it run long enough, they'll usually
come back with an image that you can recover from.
But you might have to let it run for a couple of days on the drive.
But very, very useful.
But it works.
I mean, it's gotten me out of, uh, very bad situations twice.
So, if you're looking for recovery tools, I'd highly suggest that.
No, no, no.
It sounds like you've actually done this a couple times.
Have you actually put the hard drive in the freezer before?
Actually, yes, I have.
And has it worked?
It did zip for me.
See, the thing that I heard about it was that, um, the idea, at least, that I had heard, is
that, uh, sometimes on a circuit board, uh, the circuit board's gone bad and you have, um,
particular parts that are overheating.
Um, so the idea is to cool down the hard drive so that you can get it to spin up long enough,
uh, to get the stuff off the hard drive before the parts on the, the hard drive board start
to reheat up.
If you kind of see what I'm saying.
Yes, yes.
Uh, at least that's a theory that I've heard.
It's, it's, I tried it twice, uh, and it never made a bit of difference for me.
Well, I think it depends really on which kind of, uh, of, what kind of failure.
Well, yeah, what kind of failure it is.
One thing that has tended to work for me in the past is if the board goes, you get the exact
same hard drive and you just replace the board but leave the same ladders and, uh, then you've
got pretty much a working drive again.
Yeah, actually, I have done that, uh, where I had, uh, a friend of mine who lost an eight
gig hard drive, uh, a while back and it had, I think it had windows on it and that's basically
what I did is I went on eBay and found the exact same model drive and then whenever, you
know, it costs like five bucks and then, uh, replaced the board on the drive and got it
to spin back up just long, you know, just long enough to get the data off.
I wouldn't say I'd use the hard drive anymore for critical data.
Yeah, of course not.
It was kind of cludged together at that point.
But, yeah, you're right.
It does work.
Yeah, don't give it, don't give it to those people who ride their hard drives into the
ground.
I, I actually got to say that I think I'm the only person who's ever actually said this
but the, the, the freezer thing has worked for me, I guess.
I don't know.
Maybe I'm just lucky.
And actually, I, I did say that once on MinRev Radio and no one believed me and I, that made me
very sad.
So, B, what have you been, uh, do we ask you yet?
I'm not even sure.
What's your personal show until this week?
Well, let's see.
Um, I've been working on iWar a little bit, uh, trying to get the next release of that
done with, uh, still doing the Death Row thing, Death Row Open VMS Cluster, um, maintaining
that.
Nothing really interesting there.
And, of course, uh, tonight's topic, uh, I've been doing a lot of work with, uh, that's
been primarily what I've been doing.
I just had a lot of work with iWar and trying to get all that stuff done with, so.
Are we looking forward to any new features with iWar?
Um, yeah.
Actually, I've added in PostSQL, uh, excuse me, PostSQL, Postgres, whatever.
Um.
I think we established that in PostSQL.
Yeah, PostSQL.
Okay.
PostSQL.
Um, I added that in, uh, added in, uh, HTTP logging, uh, so that you can log to a web
server, um, and a couple other features, uh, my big thing right now is to work on signal
processing for the voiceover IP part of iWar, uh, which have not had much of a chance to really
work on, but been too busy, too busy smashing bugs in the current iWar, so.
Beef smash, bro!
Mashy smashy.
Gotta be done.
I'm just picturing Beef, like, you know, trudging over the crude base with, like, you know, his,
you know, all green, like his shirt ripped to shreds like the Hulk.
Mashy!
Don't like bugs!
Yeah, that's pretty much the way I address whenever I do it, too.
All right, so since, you know, we both basically referenced a topic in the past five minutes
or so, um, the topic for the night is we're trying to talk about honeypots and user mode
Linux, and the, the immense fun you can have just sitting there, you know, mushing about
with UML and honeypots.
A honeypot topic makes me sticky.
Mmm.
And that's the end of my bad joke for the evening.
Mmm, honey.
Yes.
Okay, so, well, I mean, I guess it's like, you know, two or three people that might not
know what a honeypot is.
Honey pots are systems that are, um, basically, you want to deploy them into your network infrastructure
even though they have security holes in them.
I mean, they're basically boxes that no one else is going to use, and they're just going
to sit there, you know, you know, badly patched or whatever.
Like, for example, you know, most people, I assume, most people who know what they're
doing, when they have a, you know, computer on the network, they actually want to patch
it.
Honey pots, you don't want to.
You just want to have them sit out there with their giant gaping security holes.
Um, basically, what they're used for is, you know, research, information gathering, and,
um, some companies, hmm?
And fun.
And fun, fun, too, yeah.
So, and also some companies, uh, apparently use them to distract hackers, which, or I'm
sorry, not hackers, attackers.
Um, and basically, what they're, what they're trying to do is they want to just set them up
there on their network, and, you know, with their, with their security holes, and their
badly configured, and their default passwords, and so when, if someone comes around and attacks
your network, they'll see this box with all these problems, and they, they just are meant
to set up to look like low-hanging fruit, like, the easy stuff that can, anyone can, you know,
own with their, you know, copy of Back Orifice, and NetBus, and all that stuff.
You know, they just want to be low-hanging fruit, you know, computers with very easily
exploited weaknesses, and what, what the concept is, is, you know, when you have one of these
computers out there, or they'll have enough holes to make it look like a badly secured box
to the attacker, you know, and when they come around, it'll convince him and her to make
sure that that box is, oh, God, this is going to be the simplest one ever, and I can use
this for my base of operations to attack everything else, which is a very common strategy.
Now, what the attacker doesn't know is the machine is heavily monitored, and basically,
whenever someone tries to connect to it, because you don't want anyone else, you know, you don't,
with this part of your network infrastructure, you don't want, you know, John from accounting,
you know, using that as his primary server.
The only reason, the only person you want to use this, have this, the only person you
want to ever use this box is someone who shouldn't be using it in the first place, and if some
type of traffic is flowing in or out of it, it's going to be something that is, you want
to be looking at.
So, I guess, personally, the thing, the first part that I ever, like, stumbled across for,
like, honeypots and security, stuff like that, is, it's a very good basic introduction.
It's called An Evening with Burford, and it's by Bill Cheswick, and this actually is a chapter
in his book, Firewalls and Internet Security.
It's, the book's by Cheswick and something else, I have a copy of it.
Actually, I bet if I look at my bookshelf right now, I can see it.
Uh, Cheswick, Squint, Squint, Squint, yeah, I think I have more neat glass, was, uh, Cheswick,
Beldoin, and Ruth?
I don't know.
Down on my bottom shelf.
I'm getting old.
I'm very sad.
Old fart.
Yeah, it's a chapter in his book, um, but this, this, this actually isn't, you know, books
with a Z there, it's super leet.
Um, he's actually released this chapter to a public, or, I'm not sure if he's released
a chapter to the public, or he released a, or he released a story before he released
the book, but it's, um, actually available on the public.
Um, it's, uh, tinyurl.com slash lima3echo8alpha.
And you can also, I, I have a PDF copy of it on my computer at work, and it's, it's a really
great story.
It's basically, it's him during, you know, this is, this is like way in the origin of
the internet, it's like 1991, and it's, um, a story on basically how attacked her, how
attacked her, attacker, and I, I wrote this myself.
Ooh, someone has a hip top.
It's how an attacker is, um, you know, basically tricked, trapped, and traced.
It's, it's really cool, and it's, it's, it, I, I gotta say, it's, it's a lot like a
whodunit story.
It's, it's really good.
Um, basically, it's, you know, this Cheswick guy, Bill, he's, he's working for AT&T research,
and he set up a honeypot on AT&T's internet connection.
Um, and this, uh, person from, I don't know, Netherlands, Sweden, some, some sort of Scandinavian
country, it's, uh, you know, he basically hopped it all the way through, like, two or three
different computers, and he attacked AT&T, and they basically put him in this little jail,
and they watched everything he did, including tech and other computers, and they just, you
know, watched him for, I think it went on for a couple of months, so it was pretty interesting.
Um, so, when, when, like, previous to, what else we're going to talk about, uh, like, back
in the day, what you have to do is, you'd have to take an actual computer, like, you know,
put a hard drive, put RAM, put everything in it, misconfigure it, um, and basically let
it run 24-7 and wait to see what comes drifting in on the tide.
Um, and really, this was the only way to do it for a while, until, like, you know, uh,
computer virtualization and all kinds of fun stuff that we're going to talk about next.
And, uh, while actually researching this article, I found a fun little thing.
The term honeypot is often understood to refer to the bilge, the British children's character
Winnie the Pooh, a stuffed bear who is lured in various predicaments by his desire for pots
of honey, which, I, I, I always saw the logo, but I never actually should have understood
that that was the origin of the term.
Hmm.
Yeah.
Yeah, I never really thought about it myself.
I always thought, like, uh, it was sort of like, you know, it was a honeypot.
I mean, you always, I, I always looked at it as, uh, a play on the term of, you know,
you, you attract more flies with honey than vinegar.
Yeah, that, that, that's what I thought about it.
Yeah.
Or, I just see, like, I always saw it as, like, you know, this hacker is, like, walking
around the network and he sees this, uh, you know, pot, pot of honey and it's like,
woo, honey!
Because, you know, who, who, who, who wants to turn down free honey?
Exactly.
Yeah.
That's kind of the way I thought about it, but.
Yeah, so, yeah.
Yeah, but basically what it is, is, you know, honey, honeypot was, you, you had to run it
with a, um, you had to run into a physical server and you had to run a computer and you
had to keep it in your, you know, server room, closet, bedroom, wherever you want to put
it underneath your bed, whatever.
And, um, then, like, up until, I think, 1990, when, when did UML come out?
It was, it was released around 2.2, so I'm going to say, like, 1998, 1999.
Um, one of, one of the first big things for, you know, network virtualization, at least
in the Linux world, was something called User Mode Linux.
Now, uh, what User Mode Linux does is, basically, it allows you to run a virtual kernel on top
of your existing install.
So, you know, normally when you are booting up a Linux kernel, you have to have, you know,
a piece of hardware to do it and you could only have one kernel running on a machine.
I mean, what, what User Mode Linux did is they took all of the, uh, you know, they took
the requirements of running a Linux kernel into kernel space and they made it all into
user space.
And for those of you who don't know what, you know, user space is, um, user space is the
area in which, you know, your normal program runs.
It's like, you know, Apache, uh, Secure Shell, NFS, um, while opposed to your real kernel runs
in something called kernel space.
Uh, basically, what kernel space is, is, uh, it allows the kernel to directly access the
hardware, um, you know, low-level functions, you know, pull stuff out of RAM directly.
Uh, while in, like, user space, uh, the kernel kind of, I guess you could say insulates programs
when they're trying to access the hardware.
Like, for example, compare it to, you know, running Linux and running DOS.
DOS didn't have a kernel and therefore lockups were a lot more frequent when something happened,
uh, to the program that was currently running, uh, as opposed to Linux where if you have a
lockup, something's seriously wrong.
Mm-hmm.
Like, for example, your hard drive might be dying.
Ha-ha!
Um...
What's interesting is I actually set up kind of a, I had an extra box and an extra IP,
so I set a honeypot up, I just, uh, set up the computer with this open FTP share sitting
there on the network, no firewalls or anything, and I just let it sit there for a month and
no one touched it.
I was so surprised.
Hmm.
Well, we're actually running into that problem ourselves.
I think a lot of times, uh, you just have to be really patient, or just make your machine
more vulnerable as you see the attacks come in.
Mm-hmm.
Well, you also got to be paying attention to what, you know, the, the attack du jour is,
I guess.
I mean, I...
Really, yeah.
Yeah, well, what I used to do is, uh, when, uh, we'll talk about more about this later,
but I, I, I set up a, back in the day, about, oh, I don't know, a year ago or so, when I
first started playing with this, I, I basically set up a nice little, um, HoneyDee install,
which is a, a HoneyDee for those, we'll, we'll talk about it more later, but HoneyDee is a, uh,
sort of a virtual, virtual honeypot, um, and I set it up to have a, make it look like a,
a Telnet session was running on it, and it, I, I mean, I programmed the hell out of this.
You could Telnet in, you could give it passwords, it would make it look like it was compromised,
you know, you could enter, like, one of, like, you know, three or four different accounts,
and it'll respond to it, and give you a login prompt, and then, you know, not respond to
it, and then it would lock you out, but, but no, no one would log in, because no one uses
Telnet anymore, and I was, I was, I, that made me sad, but, yeah, and I, it's just basically
what it boils down to is the attack du jour.
What, what are people running right now?
I mean, the, I, I, meanwhile, I actually set up a, something soliciting on, uh, port
4444, which was the, I forget what that was, it was the, what, what virus did that?
My Doom on Windows that would send the shell out to that?
Or one of, like, the, it was like a, a spat of viruses.
You know, it would bind a, uh, Windows command shell out to a certain port, and I set that
up there, and I would get hammered, like, you know, 100 hits a day on it.
The blaster worm.
Blaster, that's it, thank you.
One of them, it was like, way too many, and then I think Nimda did it too, basically because
Nimda used blaster as a piggyback.
That was very interesting.
So, um, what, uh, what UML basically allows you to do is, you know, you can run buggy software
on an actual quote-unquote Linux server, um, or a Linux kernel install.
Uh, you can jail certain services, so if, you know, if, if you're running a real computer
and you're running, like, a real Apache website, you can, um, set up, so Apache runs on your
user-mode Linux box, and if Apache gets hacked, say, for example, um, your, you know, your,
your main box will get hacked, your, your super-leap porn won't get spoiled out on the internet.
Um, you can also use user-mode Linux to, uh, limit access to hardware for certain programs,
um, and generally just basically provide a, uh, level of redundancy for the systems that
you run.
Uh, like, for example, if something happens to, say, your Apache program and your, you
know, that virtualization gets taken down, your, your Samba will still be fine, and it's
just, it's just a way of, you know, redundancy for the sake of redundancy, I guess.
Um, essentially what user-mode Linux does is it provides a nice little way to, uh, run a
virtual instance of a server within your existing server, and, uh, actually I found this pretty
interesting, um, I completely forgot of this, forgot about this until someone mentioned to
me, uh, there's, there's a couple of web hosting providers out there that have, uh, are actually
starting to provide user-mode Linux-powered servers for, like, you know, 10 to 20 bucks a
month, where in reality you get this, uh, complete virtual server, you know, full root access, um,
in what appears to be your own system, while in reality it's only one physical computer,
and it's shared by many people, um, I, I forget the provider that it actually does
this, um, the one that I actually use.
Yeah, apparently there's a lot, I did a search for it, I, I, I remember when it first came
out, and me and a couple other people were basically saying, wow, this is the coolest
thing ever, and, uh, one of them that actually, one of my, one of the people that Strom and I
know actually still uses theirs, it, it, it, it really, I mean, I played on it, and for
all intents and purposes, you can tell that you have a, you know, real Linux box,
since, unless you really start poking at it, you, you, you won't discover that it's just
sitting in someone's, uh, virtual space someplace.
Right.
Um, yeah, well, the UML first came out around, uh, for 2.2 kernels, uh, I think it was like
98, 99, um, and as of Linux 2.6, it's actually got integrated into the main kernel source tree.
Um, it's pretty cool, actually, I didn't actually know it was a part of 2.6.
Uh, for a lot of people with 2.4, um, still using that, I'll aid of you, um, it's going
to be a bit of an issue, because apparently, uh, sadly enough, development hasn't actually
done much since two, since late 2004.
I was...
Yeah, but, and actually, ironically, for UMLs, I find the 2.4 UML kernel better to run, because
it supports some features that the 2.6 yet, has yet to, uh, have integrated into it, which
we can get to later.
Yeah, well, actually, I, I think 2.6 is mostly developed by the Linux people, and not actually
the UML people, or, I, I'm not exactly sure.
We're still developing that.
Yeah, I don't think, I don't think...
Oh, really?
Well, I don't know.
It's just, it's just odd the way everything kind of works out, because, I mean, I was running
user mode Linux, uh, with Debian binaries, and I basically, you know, I started running
it, and I said, oh, I wonder what version we're running in.
It said, like, 2004, you know, July 7th, and I was like, oh, crap, man, these, these binaries
are lagging way behind, and I was like, okay, let me go uninstall them, and I'll go grab
the source, and I go to the website, and I'm like, 2004, July 7th, wait a minute, I was
very confused for a second.
So, you know, we talked about honeypots, we talked about UML, um, and I'm sure all of
you are just sitting on the edge of your seat, wondering how you can put two and two together
and make this super cool UML honeypot, um, to involve cheese.
Um, well, I don't know, I guess when you're setting up your honeypot, you can have a nice
little, you know, bottle of Chianti, and a nice little, some wine there, maybe a nice
little white Zippendel.
Linux cheese and wine.
Yeah, there we go.
Actually, I found it amusing, I got into Linux World, and I was looking at some of the stuff
you can go to, and apparently there is a cheese and wine party.
A Linux cheese and wine party.
Yeah, I know, I was like, whoa, okay, that's going to be pretty interesting to watch.
Um, so, anyway, what, uh, what makes user mode Linux pretty good for honeypots is that
it basically allows you to run a badly secured Linux box on top of your well-secured Linux
box, and, yeah, if the badly secured box get rooted, your main box is fine, and there's
no really way for them to, hell, if you actually pull it off well enough, they shouldn't even
know they're in a virtual instance, and if they do realize they're in a virtual instance,
they, there's no real way to, uh, piggyback off the user mode Linux image and attack your
well-secured machine.
Well, as you're pointing out, I mean, well, as you're pointing out, and let's assume that
there is some way to do that, you can even run, you're actually running the UML kernel
within user space.
You can actually run it under a standard username.
So, even in the event that they do get out of it, pretty unlikely, you can still kind
of even jail it down even more by, of course, you know, not running your UML instance as
root, for instance.
You know what I should do?
I wonder, I should run my user mode Linux, my badly secured user mode Linux, inside a well-secured
user mode Linux, inside my host machine.
Ooh, I wonder if you can do that.
I don't even know, but I'm going to, I'm going to find out.
Double stuff paranoia.
I've heard people running user mode Linux and then running bServe, which is another
kind of emulation kind of thing, within user mode Linux.
I couldn't quite figure out why, but I was watching a, yeah, exactly.
It was like a user mode inside of a bServe mode, okay.
But I guess if you're really paranoid, you could do that.
What you should do is you should use, like, you know, your host machine, then QEMU, and
then VMware, running Zen server, running user mode Linux with your badly secured box, and
there are like eight different ways.
That way, when they actually log in, it'll be kind of like, hey, why am I using a 386 that
claims to be a Pentium 4?
I'm not, yeah.
Right.
Well, actually, I was fooling around with VMware, because I wanted to, because they released
their free version.
We're completely getting dragged off the main topic here, but we're kind of talking about
virtualization.
And all of these products were mentoring VMware, QEMU, Zen server, and what was the one, the
B, Bware, whatever it was?
Bserve?
No.
What were you talking about?
Oh, oh, Bserve, yeah.
Bserve, sorry, yeah.
All of these are virtualization things, and you can basically use all of these programs
to do exactly what we're talking about.
Basically, just hosting a badly secured machine, making a virtual network instance, and running
it on top of your existing server.
Well, actually, what's interesting about that is I found user mode Linux to be better for
honeypots.
Because, for instance, like in Bserve, it's really easy to, again, figure out you're in a Bserve
environment because it runs under the existing kernel.
It just makes a new security, it makes a new context for your virtualization to run in.
You actually don't run a different kernel.
You're under the exact same kernel as the host system, if you kind of see what I'm saying.
And then I also looked at stuff like VMware, especially Windows honeypots, kind of easy to figure out.
Anyways, all hands pointed for me to UML because they've actually put in a lot of time and effort
into making UML a honeypot-friendly kind of environment because you can actually change
the way the system looks, you know, so that it's harder for the person to detect that they're actually
within a UML environment.
Yeah, I mean, yeah, UML is basically all of the, you know, honeypot people over there,
like, they all sing to places with UML.
But, for example, UML won't run Windows.
So, if you want to run VMware, you can, you know, you can run VMware on a Windows, you can run
a VMware on your Linux machine running a Windows image.
You have to have quite a powerful machine to do that, of course, as I found out.
You can also do it in QEM, too, so.
Oh, really?
I didn't know you could do that in Windows.
Yep, you sure can.
Oh.
You can run Windows in QEM.
Yeah, I was actually fooling around with my Linux box.
I said, oh, I will run a virtual, you know, Windows 2000 server on here, and we'll just
see how it runs.
And, but I sort of, like, gave up when VMware, you know, started up and started booting the
Windows, and my load eventually topped out around 17.
And I said, okay, I don't think this is going to work.
I mean, the virtual network instance started responding to pings, but, like, you'd see, you
know, you know, two milliseconds, three milliseconds.
Wow.
30 milliseconds.
4,527 milliseconds.
And I was like, yeah, I don't think that's a good ping time.
We've got a caller on the line.
All right.
We've got May Bufo from the RC Channel.
He's got a question about what we're talking about.
All right.
Yeah, hi.
You guys are talking about running honeypots on Linux.
Yes.
And I'm just, I'm just curious.
Wouldn't one on Windows attract a little more people?
Well, to me, that's, that's the question.
But, of course, with user mode Linux, basically, you're, you're, you're basically limited to
Linux.
Well, right.
But at the same point, we were talking about VMware and everything.
And, I mean, you can run a honeypot with VMware for Windows.
But at the same point, yeah, it's questionable.
You can't, and actually, and actually, one, one problem that I kind of had with it, because
I originally wanted to run a Windows-based honeypot, and instead went to UML with Linux,
because the UML team has put a lot of effort into, you know, things like logging and stuff
like that.
So, even if the person SSH is in, you can still log their sessions.
Right.
Whereas, VMware, it gets a little bit more tricky about how you're going to log the
sessions, you know, and see what the actual, the person who penetrated the system, what
they're actually doing, aside from, like, taking the image down and doing, like, post-mortem
on the image or whatnot.
That was the reason I went with it.
Okay.
That's pretty interesting, though.
Yes.
Well, we'll actually cover it about how to, like, set it up and all this wonderful, cool
honeypot stuff.
Actually, we should talk about it now, because they were right at the, part of the,
notes where we should be talking about it.
Yeah.
Okay.
So, the three things with UML that made it so well is, basically, we're talking about,
you know, TTY logging right here.
And, well, do you want to talk about TTY logging, because you just, you know, basically did this
for about a week or so?
Yeah, sure.
And, well, the only bad thing is, in the 2.6 kernel of the UML stuff, they don't include
TTY logging.
So, you have to kind of resort back to a 2.4 kernel.
And what it allows is, anything that goes on within your UML, you can log it.
So, it doesn't matter if the user has actually SSH'd in, or pretty much how he gets into a
system, it creates a log file that you can later go through and actually even play back
in real time, just like the person who's sitting there, you know, typing it in.
You can actually play back the log file and watch what they're doing in real time.
Unfortunately, 2.6 kernel, they don't have that for it to over.
So, but that was like a definite, you know, that's a pretty big advantage to me.
I like to watch what's going on in the honeypot.
And, when he's talking about, like, playing it real time, you're playing it in real time.
It's eerie how, like, how it looks when you actually start playing it back.
You can see typos in everything.
Exactly.
And, what's interesting is, from the intruder's standpoint, it's very difficult for him to
detect that the logging is going on, because there's no additional network traffic.
Because, really, I believe the UML Linux is just passing the information back over to
the host system.
So, there's no real extra traffic.
So, like, let's say he decides, you know, to see if there's some sort of extra traffic,
to see if, like, syslogging, remote syslogging is going on.
He's not going to see it.
So, that also makes it more entertaining.
You know, makes the intruder feel more safe that he isn't being watched when he actually
is.
And, also, with the, one of the other things they put in is HP PFS, which is basically
a, basically a way of just running this complete, like, dumbed-up proc system.
It may, because when you're normally logged into a user mode in Linux, if you look at the
proc system, for those of you who don't know, proc basically gives you a lot of internal
operating system statuses in Linux.
If you look at proc, you can see, oh, you know, if you look at it, you say, oh, look
at that, I'm in user mode Linux.
But what you can do with some tools that they give you is you can basically make the proc
look exactly like it's supposed to.
And what HP PFS stands for is the Honeypot ProcFS.
You can, you know, have certain proc entries added, deleted, modified.
Basically, you can make it look like you're running this, you know, super eight-way,
X86 processor, for all they know.
Right.
Really heavily loaded down.
Yeah, it's really slow.
I don't know why.
It's got eight processors.
Processor host.
And they also have something called SKSS mode, which is basically a separate kernel address
space.
And if you're making, basically what it just does is it kind of, if you're looking at how
the user space and kernel space stuff is allocated within the memory on the UML host image, you
can, you can notice that it's following certain rules and it'll look like, if someone knows
what they're looking for, you can tell, oh, okay, it's user mode Linux.
What SKSS does is it kind of obfuscates that and does not make it look like it's supposed
to.
So it's camouflage.
It makes it look exactly like a real system.
I actually haven't played with that, so I'm not a complete expert in it.
Are you still on the line, Mibufo?
I am.
All right, cool.
Any more questions?
No, not really, though.
All right, cool.
I've got another call I'm going to grab, so I'm going to drop you off.
All right, no problem.
Thanks, man.
Sure.
So our next caller is Potrillo23 of TWAD.
Because apparently someone leaked the topic tonight for tonight's MinRev episode, and
I get a message on IRC.
My God, did you get inspired by my TWAD episode?
I'm like, what?
And apparently, like, something like last week or the week before, he did a HottiePod episode
on TWAD.
So if you want some little more information than maybe coloring stuff that we're not covering,
like, for example, I think he talks about VMware and such.
And go to TWAD.
I think it's, like, episode 80.
And let's Potrillo talk about Honeypots.
What's up, guys?
Hey.
What's up?
All right.
I'm just calling him over here from L.A., over here near you, Strom.
Sweet.
I was doing some research earlier last week on Honeypots myself and found some pretty interesting
stuff on VMware.
It turns out that VMware assigns certain MAC addresses to its virtual host, so somebody
on the LAN could, it could lead to the assumption that there's a Honeypot hosted.
So I don't know.
I just thought that was kind of interesting.
I thought I'd share that with you guys.
Well, does it necessarily mean that the Honeypot's there?
Does it more mean that it's actually a VMware instance?
Well, yeah.
It doesn't necessarily mean that it's a Honeypot there, you know what I mean?
Yeah.
But it could just, like, tip you off, you know what I mean?
Yeah.
Like, for example, if...
Mm-hmm.
Were you about to say whenever they load the, like, the video drivers for VMware?
Because that's another, like, tip-off for people hosting VMware-based Honeypots is, of course,
whenever you boot up normally, if you don't install the VMware drivers within the VMware
environment, the graphics are really bad.
You know, you get, like, 256 colors, and it just looks like crap.
But you can load all these drivers for VMware that will actually, you know, make the machine
respond and act fairly decently.
The only problem is if you're running that as a Honeypot, then if people see those drivers
loaded, like the VMware video drivers loaded, and it's pretty much a key off that, oh, this
is a Honeypot, never mind, you know, versus a VMware-based machine.
That's cool.
I've never heard of that before.
I'm going to look into that a little bit.
You might be able to get around it by just not loading those drivers, but, of course,
your display's going to look like crap and whatnot, but...
Well, to be honest with you, if your display looks like crap, I mean, you're not going
to be using the bloody thing.
Let them suffer.
Right, right.
That's true.
So I guess I can see it from both sides of the coin.
Yes, but, I mean, both Beve and I are actually, we're playing with Honeypot today, this week,
and that's what we were talking about when we were talking about the show topics, and I'm
actually, for a while, I was getting probed by Verizon out of all people, and, like, this
entire slash 16, just random wind servers were trying to connect to my computer, and my snort
protection log were picking them up.
And I couldn't tell what the hell was going on, and what I really wanted to do is I wanted
to just fire up VMware, just have something that was, you know, not my real Windows box,
you know, have a Windows server instance, you know, fire up a Windows server, have it unpatched,
and let's see if I get, you know, owned by something, and whether or not they're actually
just trying to send out harmless packets that look kind of suspicious, because I didn't
ask for them, or actually whether or not they're sending out some type of worm of some
sort, so.
I mean, VMware does have its place, but at the same point, it's not as easily camouflaged
as user mode Linux.
Yeah, I've often wondered if QEMM, or whatnot.
Quick QEMM, you're dating yourself there.
Yeah, I know, thanks.
Yeah, I got more conventional memory out of that.
God, I remember QEMM.
Um, quick, quick pop quiz, what does QEMM stand for?
Oh, my God.
The Quarterdeck Expanded Memory Manager.
Oh, that's right.
Oh, man.
When I was going to say Quark Express Memory Manager, I'm like, no, that's not it.
Okay, B, you can keep on going, we'll start back on topic.
Well, anyways, I'm wondering if you'd be better off running it in something like that
than, say, VMware.
I wonder if it'd be easier to camouflage, but I don't know.
I was just thinking out loud, I guess.
Well, I think we're going to have to look at QEMU here, or QEMM.
I actually had no clue that I could actually win Windows, which is really interesting.
All right, so, you know, basically what the advantage of running a virtual network instance
is, you know, you don't need a separate computer to run it.
It has less power consumption, it has less cost, you know, less space is taken into your rack
or your server room or your bedroom, for that matter.
And all your monitoring software can be on your host machine there.
So all the stuff that's actually, you know, looking at this stuff and monitoring it,
making sure nothing mean happens.
All your stuff is, like, you know, right on your host machine, so, you know, it'll notice
that it's no type of, like, you know, ARP spoofing or any type of crazy thing,
because if your host machine mysteriously goes offline, so won't your honeypot.
Sorry, Petrillo, but are you still here?
Yeah, I'm still here.
All right, do you have any more questions?
No, I'm all right.
Yeah, I just completely forgot to mention you there.
That's all right.
Okay.
All right, well, thank you very much for calling in.
All right, I'll see you guys.
See you later.
And that's, oh, by the way, that's, that's, that's, that, um, oh, I guess not.
I think that's TWAT episode 80.
I figured that he would know, but I guess not.
Okay, so, um, setting one up is really simple.
I had one about, um, 10 minutes running on Debian, and it was, it was insanely simple.
It was, basically, this guy has wrote this very nice tutorial.
It's about, like, you know, I, I think it's, like, five packages you have to install.
Um, and once you do that, it's just a matter of downloading the kernel image, um, popping the,
making a root file system for it, and then running it.
And the, uh, Debian one, for those of you running Debian, is, uh, tinyurl.com slash MikePapaUniformGolfRomeo.
And, um, the only thing that I had to fix was a couple of his URLs, because this one was written in, uh, 2003, 2004.
But, um, either way, the version of his Debian was, um, an older version, which actually works out quite well if you're running a honeypot,
because you don't want to run up-to-date software.
The hell's all the security holes patched?
Um, and, uh, I just had to change a couple URLs, because his URLs were bad.
But other than that, everything seemed to work fine, and, um, it, it turned out fine.
Oh, yeah, and I couldn't install SSH, because it was trying to grab the, uh, my current version.
Which was, it was, it was under the assumption that, uh, the version of Debian I was running on my computer,
and the version of Debian I was installing onto the honeypot was the, uh, same version, which was incorrect in this case.
And, how long did it take you to, you, you, you run Gen2, we won't hold that against you, but, uh,
how long did it take you to set that up?
Well, we're going to mention it, please.
Um, actually, I rolled up my own image in that case.
I actually have a couple other images.
I have a, uh, Slackware 10.2 image, and, um, not very long at all.
Gen2, of course, you build in a change root environment anyways.
So, really, all you have to do is make, and user mode Linux, uh, the file system is kept as a, as a file,
basically, on the host system.
Yeah.
So, um, uh, building it really was basically DDing out the image, uh, about the size that I wanted,
formatting it, you know, uh, change rooting into the environment, doing the normal Gen2 install, in that case.
Um, and just proceeding like a normal, just install, really.
Um, uh, there are also a lot of images that you can find that are even pre-built.
If you go to, I think it's, uh, user-mode-linux.sourceforge.net.
Um, and if you look through their front webpage, they actually, there's a guy who has images out there that you can actually download.
So, if you want to run, you know, Slackware, or he even has, like, Slackware 4.0, you know, as a Honeypot image.
Yeah, he basically has a Honeypot image.
Right, he's already rolled out a lot of these images for you.
So, um, you can just even grab those or build your own.
Um, it's not that hard to really roll out your own image.
Um, it, it took me, I don't know, well, I don't know, several hours to build up my image.
Really, I spent more time putting vulnerabilities into my images than anything.
Maybe we'll put back.
He's got another Honeypot question for us.
Oh, okay.
Yeah, I'm sorry to bug you guys again, but I'm just wondering, uh, if you leave certain processes open to, well, susceptible to attack, you know, like, things like Telnet or NetBIOS on Windows, would you notice, um, people going after the machine faster, depending on what's open and what's not?
Well, I mean, that's, that's, that's a good question.
Well, actually, um, in my case, uh, as I said, I've been running my Gen 2 image, uh, for a little while.
And, as I said, I'm probably gonna, I'm probably gonna switch images several times.
But, um, from Snort, I really haven't noticed any, other than a lot of, uh, uh, Microsoft SQL probes, uh, a lot of, a lot more attacks that would have been targeted toward Windows.
Now, I don't know if that means that my upstream provider is maybe blocking some ports to keep me safe, uh, which would be kind of a pain in the ass.
But I really haven't noticed that it would get attacked any faster.
What about you there, Black?
Um, I have noticed, in my case, it's, a lot of the stuff that you see for, like, automated probes are just, like, worms.
Like, for example, um, I, I've seen a boatload of, uh, like, Microsoft Slammer, uh, SQL server probes.
That's what I've seen, yeah.
Yeah.
And, like, uh, gobs of them.
And, uh, my, the other, the other big hit was the, uh, look, I, I think it's either, you know, it's Verizon's Win servers doing something to me.
I'm not exactly sure what it is.
But, I, I, I mean, if you, if you're running services that are vulnerable to certain worms out there, you'll, you'll catch the worms.
Which, I guess is my, you know, if you're interested in that, go right ahead.
But, at the same point, I, I'd be much more interested in having someone, you know, real and live at the other end of the line.
Right.
Well, that's pretty interesting.
Yeah.
And, it also comes back to what we were talking about before was the, you know, what's, what's the attack du jour?
I mean, you can have a Telnet box open, but if not, you can have a Telnet port open, but if no one tries Telnet anymore, you're hosed.
Yeah, that is true.
Yeah.
So, basically what it is is just, yeah, just, what I would do personally is I would, you know, just watch, start watching full disclosure and, you know, bug track and say, you know, if, if there's a giant, you know, open SSH flaw that just got posted, you know, run open SSH and see what happens there.
Because, you know, people will start, you know, scanning for it and looking for it and all the skitties will be out, you know, checking them out.
And, also, another thing I did for, especially, you know, not necessarily Apache vulnerabilities, but add-ons like, you know, the AWStat or AW, God, I can't remember the name now.
Anyways, was just go through my, my, my good working web server logs and see what's been hitting it, you know.
So, I'd see, like, lots of AWStat PL requests.
Yeah.
Well, that's probably a good thing to add in, you know.
I mean, of course, it didn't work on my, on my regular web system, but it gave me a clue as to what people are looking for.
So, then I'd go and say, okay, let me find a good old archive copy of, you know, this crappy program or, you know, this program that has lots of holes in it and then throw it up there to kind of speed things up.
So, yes.
Right.
Yeah, and that comes back down to the attack du jour.
Exactly, yeah.
All right.
You have to factor in, of course, though, how popular the exploits are.
I mean, are there certain types of things that are more popular?
Like, I don't know, things running on, say, like you guys were talking about Apache, things like that, certain more popular programs over other ones?
Well, I mean, what it boils down to is what is most likely to receive a hit.
I mean, people are scanning for vulnerabilities that will most likely be unpatched.
Right.
I mean, the AW, people will be scanning for them.
When I say people, I mean real people, as opposed to, like, we're talking about Slammer over here, and Slammer's been around for, what, two or three years?
And that's just, you know, worms that people who haven't patched their systems yet, and they're infested with the virus.
People will be scanning for vulnerabilities that just haven't been patched yet.
So, for example, if you see tomorrow that, oh, there's a huge hole in Apache, you know, 1, 3, 3, 4, you will, you will, if you're running, people will start looking for Apache 1, 3, 3, 4, and start hitting it with this exploit.
Can they scan for newer exploits and the older ones at the same time, or does it work?
Oh, yeah, they can scan for whatever they want.
If you want to, like, start banging against it, you can start trying for all kinds of things.
Okay.
Well, thanks, guys.
All right.
I think we answered your question.
I hope you did a good job.
Yeah.
Glad I could give you something to talk about.
Mm-hmm.
Okay, any time, man.
All right.
Take it easy.
Later.
Okay, so you have your user mode Linux set up, and you have it full of exploits.
I guess the next question with the honeypot, the other part of the honeypot you need to set up is you need to find out a way to monitor it.
And the way with user mode Linux, you know, we talked about TTY logging, which is, we discussed that already, and that's basically your first line of defense,
because basically you'll have a nice little log of whatever the person did.
And programs you can run on your host machine, for example, there's Snort, which is an intrusion detection system.
And it's not the, you know, primo, you know, IDSs to end all IDSs, but it's free, and it runs on Linux.
And it's fairly okay.
It's available at www.snort.org.
And if you're running Snort, there's another add-on to it that provides all their alerts and everything with a nice web interface to it.
And that's, it's called BASE, or ACID-BASE.
ACID stands for Analysis Console for Intrusion Detection.
Yeah, I think they took that over.
I think it now stands for Basic Analysis something, it stands for something different.
Oh, they actually merged?
It ended up forking.
Oh, well, I know BASE installed, yeah.
Yeah, basically ACID wasn't being maintained anymore, so actually a local group here in town ended up taking it over
and started rewriting it and adding new code and making it better.
Yes, and they forked it, and then all the ACID people said, hey, use BASE, it's so much better now.
Right, right.
Well, I mean, nobody used, well, as I said, you know, BASE or ACID was pretty much non-supportive anymore.
I mean, it wasn't getting updated, and I think that's the reason why BASE came about.
But, yeah, yeah.
Yeah, and that's available at tinyurl.com slash papaecho9whiskey8.
And also, there's everyone's favorite, TCD dump, and that's basically going to give you a nice little raw PCAP capture
of everything that's going on over on your computer.
Which, actually, I do, I write out PCAPs for pretty much the entire session that I have the honeypot up.
I write out PCAPs for, because then I can go back if I want to and use, like, TCP replay or something like that if I want to, you know,
and basically regenerate the attack or whatnot and just basically grab all the information,
all the traffic that happened while the attack was going on or whatnot.
All right.
So, now, the other question, I guess we could sort of, like, go on to our own little favorite stories here,
because we're kind of running short on time.
Actually, I have one other thing that I also do, just real quick.
Oh, sure.
I'm sure a lot of people are familiar with, like, Tripwire, things like that.
Yeah.
There's a program called Aid, and I actually made a tiny URL for it.
It's tinyurl.com to Sierra Sierra to Oscar, because it's kind of a long URL.
And it's very similar to Tripwire.
And what I do is, before I put my image online, I make a snapshot of it using something that is very similar to Tripwire,
so that whenever the system gets compromised, I can take the image offline, rerun it,
and then see what files have changed, and then, you know, kind of mark what exactly has happened.
But anyways.
That's actually a good idea.
I should have done that beforehand.
Oh, well.
Because, personally, I just set up my – I finally released my UML image out to the world this afternoon.
Actually, I finally finished just the last bit right before the show, being like 845 rolls around,
and I'm on the call with Beave, and I said, okay, well, SSH is up now.
Just to have a quick other thing, for those of you who aren't interested in running user mode Linux,
there's another program out there called HoneyD, which is not quite a full-fledged honeypot,
but it allows basically – it allows you the ability to emulate most of the features of a honeypot.
HoneyD is a daemon that runs on the server and eliminates a separate machine on the network.
And, basically, you can configure this, you know, faux machine to respond any which way until Sunday.
You know, like 100-millisecond latency, 10% packet loss, you know, return TCP fingerprint of a AX 4.2 server, etc.
It's very interesting what they did with it.
And, basically, also what you can do is you can also configure it to point the services hosted on your own machine,
say, like Apache, or you can do what I did, and what they also tell you you can do is run a bunch of scripts
that emulate broken services so you can take a look at how people are probing you.
I have a ton of scripts that just emulate a very badly secured machine.
Like, I was talking about my Telnet script.
I have a web script that looks your HTTP request, and if it looks like you're returning a CodeRed attack
or something like CodeRed or NimDir, one of those, it will return you a response of, hey, it worked,
so you can try to connect to it.
It was pretty interesting.
One of the things I actually did was set up a script that looked like an open relay for spam connections,
and if you would send a spam connection and the person would connect to it and try to send a relay message out,
and it would accept it, and it would log it to a file for me.
And when I had, like, gobs of amount of bandwidth, when I was on Speakeasy,
what I would do is I would send their probe message back to them when I was bored,
and I'd watch them connect and start relaying messages through me,
or what they thought was relaying messages to me.
In reality, it just gets logged to my hard drive.
So it was a fun feeling, you know, sitting there watching them waste their time and effort
and me just, you know, taking a bullet for the Internet for me.
That's me.
Exactly.
Getting back at them.
Yeah.
Look at me.
I'm so nice.
Someone should nominate me for a saint.
Ratchet, I nominate you for a saint.
Oh, thanks.
The Church of Strom.
Ratchet.
Yes.
He's going to nominate me, but he'll just procrastinate it, and it'll never get done.
You're never going to let that down, you know.
I know.
So, while we were talking about stuff that we did with, what we noticed for the Honeypot,
what, you know, you were talking about your slammer request and your other things.
Is there any, if you've gotten, have you gotten owned yet?
Any, any super elite Chinese hackers?
No, not really.
I've, I've had a couple of, a couple of things I've come across where they were close,
but didn't really get to where I wanted them to get to.
What about, what about your friend's Honeypot?
Now, my friend's Honeypot was another matter.
Actually, what had happened to him is he saw somebody trying to do, I believe it was the
AWStatPL, one of those old bugs that had been out there for a while, and basically he was
going out and trying to grab a Perl bot to, you know, take, well, basically download the
Perl bot and run it as Apache and join this particular IRC server so that they could pretty
much control the machines from the IRC server, basically botnet.
And what he decided to do was he was looking, even though it didn't actually get on the
actual Honeypot, he looked through and pulled down the bot code and saw that there were two
administrators for the botnet.
And one of them was called Dock, I believe, and one of them was called Timer.
So he actually used Tor to connect to the IRC server that the person was controlling the
botnet from and connected up and saw that, sure enough, that Dock was logged in, D-O-C-K.
And realized, wow, he's not using his other administrator account.
So after chatting with the guy for a little while, who was evidently in Romania, which I've
typically found, I run into a lot of botnet guys who are in Romania, I don't know what's
up with that, but he saw that he wasn't using one of his admin accounts, so he kind of waited
around, talked with the guy for a little while, the guy ended up, I think, taking him off the
channel, whatnot, but waited around, figured the guy had to go to sleep at some point in
time, and then ended up joining the channel and then changing his nick over to Timer, which
was the other botnet controller.
The guy had actually de-voiced the channel, so he couldn't send, I guess he thought that
he couldn't send commands to the botnet, but he could PM, private message, each individual
bot that was connected.
So his big plan and his big Robin Hood move, I guess you could call it, was to tell each
bot to, considering he had known what exploit he had come through, was to change mod 0, 0, 0,
0, 0, AWStats PL first, leave the log...
So make it not executable.
Exactly.
And then leave a little syslog message with the logger command, you know, echo, hey, your
machine's been owned, please upgrade AWStats or whatever you're using.
And then proceeded in going through each particular bot and taking each one offline.
Basically just going through, considering, I mean, he had the same control as the botnet
owner, so he would just go through, send the botnet, like, first PS, and then it would
PM him back, like, the process list, and then going through and just killing off each process.
And so he would see each bot that was connected actually disconnect.
So then he got it down to where...
So he finally got the channel down to where there was no more bots left.
And, of course, the original owner of the botnet wasn't around.
And then pretty much just killed off everything that he had left behind.
The only problem is the legalities of that, you're, you know, you're kind of, at that
point, even though you're trying to, you know, do something noble, and I guess you could
say, you know, make sure these machines aren't vulnerable again, you're still, you know,
modifying machines that are not yours.
But, you know, he kind of had, like, the Robin Hood complex thing.
Exactly.
I think Robin Hood was a very, very apt, I don't know, simile?
Or was it an analogy?
That's what I'm talking about.
Metaphor.
Metaphor, yeah.
Metaphor, thank you.
But leave it to the frame or nothing.
Yeah, don't leave it open.
Kill it all off.
And then, you know, sure, it might give the admin a little bit of headaches, but at least
they'd know, and at least the machine wouldn't be owned anymore.
Because, you know, I mean, let these guys turn around and use them for spam or whatever
they can, you know, get away with at that point.
So that was, like, pretty much his idea.
Well, essentially what your friend did to the admins was your, it's opposed to, you
know, taking a Band-Aid off slowly or just ripping it off and dealing with the consequences.
Mm-hmm.
You know, deal with the pain.
Exactly.
You're not going to have to fix it or anything, or as opposed to, you know, letting it fester
there and...
Right, right.
But, I mean, legally, that's a whole...
Yeah, exactly, exactly.
I mean, as noble as it is, it probably isn't the best thing to do.
And actually, he was using Tor because one of the big things, you know, he didn't want
to connect up and then have the bot that owner know exactly where he's coming from because
of a company he didn't work with.
Exactly, for, you know, you know, the guy might get pissed and do, like, denial-of-service
attacks on him.
So, you know, Tor's a nice thing in that case.
And a lot of these networks that run botnets are just really small networks or just machines
that they've set up themselves.
So, kind of interesting.
All right.
Well, we've got about five minutes left, so...
Do we have announcements?
No, we have announcements this week.
Let's do DC2 and 3 this week.
Don't forget Layer 1 in April.
Layer1.info.
I'll be going to Linux World April 3rd through 7th in Boston.
So, anyone in the general Boston area, I think I'll be there.
Koresh will be there.
Red Nerd will be there.
I think my work has managed to give me all four days off, even though I only asked for
one.
So, I'm not sure what the heck I'm going to be doing all those days, but I will be, you
know, living on the convention floor, getting free stuff.
Partying.
Yep.
Having my cheese and wine.
There we go.
Mm-hmm.
Yep.
Steve, do you have any announcements that you would like to make?
Oh, man.
Not really right off.
No.
Next week's show will be about Interzone.
So, if you have Interzone stories or, you know, gripes or whatever, send them in on the
show, and hopefully, you know, Strom will actually post this up to the archives so people
will be able to listen to this.
It'll be up tonight.
It'll better be.
Um, Shouts!
Steve, do you have any Shouts?
Oh, yeah, definitely the Telefreak crew, all my buddies over at Telefreak, the Death
Row Cluster, the OpenVMS Death Row Cluster, all those guys who use that machine every freaking
day, or those machines, I should say, it is a cluster.
That's about it.
Seriously, we'll have to, like, have you come on and talk about VMS and, like, the three
people that use it that use the cluster.
Oh, dude, you should get on.
You've never seen a cluster.
We have so many people use the cluster.
Really?
Everybody thinks it's, like, three people, but if you get on the middle of the day, we
always have, like, I don't know, 40, 50 people logged in to the cluster.
Are you sure it's, like, not only three people with, like, tons of Tor clients?
It could be, I don't know, but most of these feet now, most of them are in there because
we have a BBS on the Death Row Cluster, and some of them just get on for the BBS, some of
them just get on to use the machine for email, some of them write code, actually write code
for VMS, believe it or not.
All right.
The sick, sad folks that they are.
I know.
I'm sorry.
I shouldn't be knocking VMS people.
I've never actually...
I was going to say, don't...
Aren't you a big AS400 guy?
Stank is.
Stank will be sitting there going, like, listen to this going, oh, man.
VMS guys.
You know, people use VMS for, like, child molesters and...
Yeah.
Okay.
All right.
But, yeah, that's about the end of my shout-outs there.
Strom, do you have any shouts?
Shouts to Mibufo for asking totally awesome questions and...
Indeed, indeed.
And shouts to the Auto Club of Southern California.
Did you break down lately?
No, they make dealing with the DMV much easier.
Oh, okay.
I'll send a shout-out to Petrillo, too, for showing out there.
And I guess if you want to talk about honeypots on VMware, go listen to his TWA Tech episode.
That's twatech.org.
I don't know.
Shouts to you, Beaver, coming on.
He's basically turning me on to this whole user-mode Linux thing, which I've never actually...
I played with Lightly in, like, 2003, but beyond that, I was never ever even thought of actually setting it up like this.
Silly me.
It's not fun.
The site of the week is www.honeyd.org.
H-O-N-Y...
No, sorry.
I could spell you that wrong.
Oh, man.
I'm tired.
H-O-N-E-Y-D dot O-R-G.
Email.
Please email us.
Come on.
Email us your Interzone stories or anything over the past three or four weeks that people have missed.
We have completely discussed the YIG slash DIG topic to death.
Thank you very much.
Radio at binrev.com.
As always.
Strom, what's closing music tonight?
Closing music is something from OC Remix.
It's actually a pretty sweet remix of some music from Mario Paint, surprisingly.
All right.
Well, we'll be looking forward to listening to that.
Yeah.
So, as always, we will see you next week.
Same hack time.
Same hack channel.
Bye-bye.
We'll be right back.